State the bug bounty scope where reporters read it

SECURITY.md

@@ -8,7 +8,23 @@ Only the latest version is supported with updates.
 | ---------- | ------------------ |
 | 20260924.2 | :white_check_mark: |
 
+## Scope
 
+The target is the sanitizer library as written: HTML input that the
+sanitizer lets through and a browser then acts on, or input that makes the
+sanitizer throw, hang, or consume inordinate resources.  The
+[attack review ground rules](docs/attack_review_ground_rules.md) list what
+counts as a win.
+
+Out of scope:
+
+* The project's infrastructure: GitHub, the CI runners, and Bugcrowd.
+* Other OWASP repositories, projects, and websites.
+* Information that is public by design, such as author and committer
+  addresses in the commit history of a public git repository.
+
+A report needs an example input and what it does.  A report with no input
+is closed as not applicable.
 
 ## Reporting a Vulnerability
 

docs/attack_review_ground_rules.md

@@ -31,7 +31,7 @@ If you wish to remain anonymous, say so in your report.
 
 ## Out of Bounds
 
-The target is the sanitizer as written.  Attacks on the project's infrastructure, such as GitHub, the CI runners, or Bugcrowd, are out of bounds.
+The target is the sanitizer as written.  Attacks on the project's infrastructure, such as GitHub, the CI runners, or Bugcrowd, are out of bounds.  So are other OWASP repositories, projects, and websites, and information that is public by design, such as author and committer addresses in the commit history of a public git repository.  A report with no example input is closed as not applicable.
 
 ## Questions